Wireless, VPNs, Network Access Control & Segmentation

#Wireless Security

#What is this?

Wi-Fi sends traffic through the air, where anyone nearby can receive it. Wireless security is how a network proves who may join and encrypts traffic so eavesdroppers can't read it.

#Why it matters

A wireless network extends your perimeter into the car park. Weak Wi-Fi security gives an attacker a network foothold without ever entering the building, and a fake access point can harvest corporate credentials.

#How it works

Two modes:

Enhanced Open (OWE, Opportunistic Wireless Encryption) encrypts open guest networks without a password, protecting against passive sniffing (not against a rogue access point).

802.1X / EAP-TLS join
Laptop (supplicant) ──EAP──► Access point (authenticator) ──RADIUS──► Auth server (NPS/ISE/FreeRADIUS)
     │◄────────────── TLS handshake inside EAP: server cert checked, client cert presented ─────►│
     │◄────────── success + per-session keys derived ──────────────────────────────────────────│
     └── then the 4-way handshake installs encryption keys for this session only

#Wireless attacks

In practiceThe client setting that decides whether an evil twin works is server-certificate validation. A correct enterprise Wi-Fi profile pins the CA and the server name:

# wpa_supplicant.conf — WPA2/WPA3-Enterprise with EAP-TLS
network={
    ssid="ACME-Corp"
    key_mgmt=WPA-EAP
    eap=TLS
    identity="laptop-4471@acme.com"
    ca_cert="/etc/certs/acme-radius-ca.pem"            ← only trust our RADIUS CA
    domain_match="radius.acme.com"                     ← and only this server name
    client_cert="/etc/certs/laptop-4471.pem"
    private_key="/etc/certs/laptop-4471.key"
    ieee80211w=2                                       ← protected management frames required
}

Remove the two validation lines and the laptop will authenticate to any access point broadcasting "ACME-Corp."

🎯

On the job. Check managed Wi-Fi profiles (MDM / Group Policy) for server-certificate validation, prefer EAP-TLS with device certificates, and make sure guest Wi-Fi lands on an internet-only network.

#Security angle

Wireless intrusion detection (WIDS) watches for rogue access points and deauthentication floods. Put guest Wi-Fi on a separate network with internet access only.

#IPsec and VPNs

#What is this?

A VPN (virtual private network) creates an encrypted tunnel across an untrusted network so that traffic behaves as if on a private network. IPsec (Internet Protocol Security) is the standard suite that does this at the network layer.

#Why it matters

IPsec underpins site-to-site connections between offices and clouds, and many remote-access VPNs. VPN appliances are also among the most exploited internet-facing devices, so they matter to both defenders and attackers.

#How it works

IPsec has two protection protocols and two modes:

Transport mode (host-to-host): original IP header kept, payload protected
  [ IP hdr ][ ESP hdr ][ TCP + data (encrypted) ][ ESP trailer/auth ]

Tunnel mode (gateway-to-gateway, site-to-site VPN): whole original packet wrapped
  [ NEW IP hdr ][ ESP hdr ][ original IP hdr + TCP + data (encrypted) ][ ESP auth ]

Other VPN types:

In practiceWhat a healthy site-to-site tunnel looks like on a strongSwan gateway:

$ swanctl --list-sas
office-to-aws: #12, ESTABLISHED, IKEv2, 1d2f…_i 8a9b…_r
  local  'vpn.office.acme.com' @ 198.51.100.10[4500]
  remote '35.176.0.10' @ 35.176.0.10[4500]                 ← port 4500 = NAT traversal in use
  AES_GCM_16-256/PRF_HMAC_SHA2_384/ECP_384                  ← IKE: modern AEAD + ECDH
  established 3h ago, rekeying in 20h
  office-net: #31, INSTALLED, TUNNEL, ESP:AES_GCM_16-256     ← tunnel mode, ESP
    10.10.0.0/16 === 10.200.0.0/16                         ← only these networks cross the tunnel

📰

Real incident — Fortinet VPN credential leak (2021). A path-traversal flaw in FortiGate SSL-VPN (CVE-2018-13379), patched in 2019, let attackers read a file containing users' VPN credentials. In 2021 a criminal forum published working credentials for around 87,000 devices that had never been patched — or had been patched without resetting passwords. Patching closes the hole; it doesn't revoke what already leaked.

🎯

On the job. For every VPN appliance: patch on an emergency timeline, require MFA, alert on logins from new countries, and after any credential-exposure bug, force password resets as part of the fix.

#Security angle

• VPN concentrators are a top initial-access target; many mass-exploitation campaigns have hit edge VPN appliances. Patch them as emergencies and put them behind MFA.
• A VPN puts a device on the network; if the device is compromised, so is your network. This is why zero-trust access (per-application, per-request) is replacing broad VPN access. See AWS Verified Access.
• Pre-shared keys in site-to-site VPNs are often weak and never rotated; prefer certificates.

#Network Access Control and Segmentation

#What is this?

Network access control (NAC) decides whether a device may connect to the network at all, and which part of it. Segmentation divides the network so that a compromised device can reach as little as possible.

#Why it matters

Ransomware spreads laterally across flat networks. Segmentation turns "the whole company is encrypted" into "one segment is."

#How it works

#NAC

1. A device plugs in or joins Wi-Fi.
2. 802.1X authenticates the device or user through RADIUS (devices that can't do 802.1X, like printers, fall back to MAC authentication bypass, which is weak because MAC addresses are easy to spoof).
3. Posture check — is the device managed, patched, running EDR (endpoint detection and response)?
4. The device is placed in the right VLAN or given the right access list: corporate, quarantine/remediation, guest or denied.
5. Continuous monitoring can move it later if posture changes.

#Segmentation building blocks

📰

Real incident — NotPetya (2017). Delivered through a hijacked update of Ukrainian accounting software, NotPetya spread across flat corporate networks in minutes using stolen credentials and an SMB exploit, wiping machines at Maersk, Merck, FedEx/TNT and others for an estimated $10 billion in damage. Organisations with segmented networks and restricted admin credentials lost far less.

🎯

On the job. Test segmentation the way an attacker would: from a standard workstation, try to reach domain controllers, backup servers and other workstations on SMB, RDP and WinRM. Every successful connection that isn't needed is a lateral-movement path.

#Security angle

Segment by what talks to what, not by org chart. Start by mapping actual flows (flow logs, NetFlow), then deny everything else; the crown jewels (domain controllers, backup servers, hypervisor management) get the tightest zones.

#Converged Protocols

#What is this?

Services that used to run on their own dedicated networks (telephone, storage, industrial control) now run over IP networks shared with everything else.

#Why it matters

Convergence saves money but brings IP-network attacks to systems that were designed assuming physical isolation.

#How it works

🎯

On the job. During an internal assessment, list everything on the network speaking VoIP, iSCSI or industrial protocols, check whether it sits on its own segment, and whether authentication (SIP over TLS, CHAP, OPC UA security modes) is actually enabled rather than just supported.

#Security angle

The common thread: isolate the converged traffic onto its own segment, and add the authentication and encryption the original protocol lacked.